If you learned from my posts, inspired, or encouraged to grow in the cybersecurity and digital forensics, I would really appreciate your vote and support - Husam Shbib!
MyCyberNews

Search

Find merged stories by title or summary.

Vulnerabilities & Patches
Emerging1 src

CVE-2026-49989 - CrateDB's Blob HTTP handler bypasses authorization

CVE ID : CVE-2026-49989 Published : Aug. 14, 2026, 4:29 p. m. • 36 minutes ago Description : CrateDB is a distributed SQL database. Prior to versions 6. 2. 8 and 6. 3. 2, any authenticated user can read or delete any blob whose SHA-1 digest they know, and can plant new blobs unconditionally, in any blob table, regardless of `GRANT`s. CrateDB has two ways to access blob storage: SQL (`SELECT ... FROM blob. ` and friends) and the blob HTTP API (`GET • PUT • DELETE /_blobs/{table}/{digest}`). The SQL path goes through `AccessControl`, which is what enforces privilege grants; that's why `SELECT digest FROM blob.secret_blobs` fails for a user who has no grants on the table. The HTTP path authenticates the request but never asks `AccessControl` whether the authenticated user is allowed to touch the table.

·CVEFeed
Read →

You've reached the end of current stories for this search.